DETECTING ANOMALOUS BEHAVIOR OF A DEVICE

1 . A method of detecting anomalous behavior of a device, the method comprising:

generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device;

gathering information describing current activity associated with the user device; and

determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

2 . The method of claim 1 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing locations at which the user device was utilized; and

gathering information describing current activity associated with the user device further comprises gathering information describing a location at which the user device is currently being used.

3 . The method of claim 1 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and

gathering information describing current activity associated with the user device further comprises gathering information describing usage of applications accessed by the device.

4 . The method of claim 1 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing times at which activity previously occurred; and

gathering information describing current activity associated with the user device further comprises gathering information describing times at which current activity occurred on the device.

5 . The method of claim 1 further comprising periodically retraining the trained model.

6 . The method of claim 1 further comprising generating an alert after determining that the user device has deviated from normal activity.

7 . The method of claim 1 further comprising initiating a remediation workflow after determining that the user device has deviated from normal activity.

8 . A system for detecting anomalous behavior of a device, the system including computer program instructions that, when executed, cause the system to carry out the steps of:

generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device;

gathering information describing current activity associated with the user device; and

determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

9 . The system of claim 8 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing physical locations at which the user device was utilized; and

gathering information describing current activity associated with the user device further comprises gathering information describing a location at which the user device is currently being used.

10 . The system of claim 8 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and

gathering information describing current activity associated with the user device further comprises gathering information describing usage of applications accessed by the device.

11 . The system of claim 8 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing times at which activity previously occurred; and

gathering information describing current activity associated with the user device further comprises gathering information describing times at which current activity occurred on the device.

12 . The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of periodically retraining the trained model.

13 . The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of generating an alert after determining that the user device has deviated from normal activity.

14 . The system of claim 8 further comprising computer program instructions that, when executed, cause the system to carry out the step of initiating a remediation workflow after determining that the user device has deviated from normal activity.

15 . A computer program product for detecting anomalous behavior of a device, the computer program product disposed on a computer readable medium, the computer program product including computer program instructions that, when executed, carry out the steps of:

generating, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device;

gathering information describing current activity associated with the user device; and

determining, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity.

16 . The computer program product of claim 15 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing locations at which the user device was utilized; and

gathering information describing current activity associated with the user device further comprises gathering information describing a location at which the user device is currently being used.

17 . The computer program product of claim 15 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing usage of one or more applications accessed by the device; and

gathering information describing current activity associated with the user device further comprises gathering information describing usage of applications accessed by the device.

18 . The computer program product of claim 15 wherein:

generating a trained model for detecting normal activity for the user device further comprises generating the trained model using information describing times at which activity previously occurred; and

gathering information describing current activity associated with the user device further comprises gathering information describing times at which current activity occurred on the device.

19 . The computer program product of claim 15 further comprising computer program instructions that, when executed, carry out the step of periodically retraining the trained model.

20 . The computer program product of claim 15 further comprising computer program instructions that, when executed, carry out the step of initiating a remediation workflow after determining that the user device has deviated from normal activity.